Configure OpenVPN server with certificate management and client automation

#!/usr/bin/env bash
set -euo pipefail

# OpenVPN Server Installation and Configuration Script
# Supports Ubuntu/Debian and RHEL-based distributions

# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default values
COUNTRY="${1:-US}"
PROVINCE="${2:-CA}"
CITY="${3:-San Francisco}"
ORG="${4:-Example Corp}"
EMAIL="${5:-admin@example.com}"
OU="${6:-IT Department}"

# Usage message
usage() {
    echo "Usage: $0 [COUNTRY] [PROVINCE] [CITY] [ORG] [EMAIL] [OU]"
    echo "Example: $0 US CA 'San Francisco' 'My Company' 'admin@mycompany.com' 'IT'"
    exit 1
}

# Error handling and cleanup
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop openvpn-server@server 2>/dev/null || true
    systemctl disable openvpn-server@server 2>/dev/null || true
}
trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

# Auto-detect distribution
echo -e "${YELLOW}[1/15] Detecting distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            FIREWALL_CMD="ufw"
            OPENVPN_SERVICE="openvpn-server@server"
            NOBODY_GROUP="nogroup"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_CMD="firewall-cmd"
            OPENVPN_SERVICE="openvpn-server@server"
            NOBODY_GROUP="nobody"
            if ! command -v dnf &> /dev/null; then
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum update -y"
            fi
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            FIREWALL_CMD="firewall-cmd"
            OPENVPN_SERVICE="openvpn-server@server"
            NOBODY_GROUP="nobody"
            ;;
        *) 
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"

# Update system packages
echo -e "${YELLOW}[2/15] Updating system packages...${NC}"
$PKG_UPDATE

# Install OpenVPN and Easy-RSA
echo -e "${YELLOW}[3/15] Installing OpenVPN and Easy-RSA...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL openvpn easy-rsa iptables-persistent
else
    $PKG_INSTALL openvpn easy-rsa iptables-services
    systemctl enable iptables
fi

# Set up Easy-RSA certificate authority
echo -e "${YELLOW}[4/15] Setting up Easy-RSA certificate authority...${NC}"
mkdir -p /etc/openvpn/easy-rsa
cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/ 2>/dev/null || cp -r /usr/share/easy-rsa/3/* /etc/openvpn/easy-rsa/
cd /etc/openvpn/easy-rsa
./easyrsa init-pki

# Configure Easy-RSA variables
echo -e "${YELLOW}[5/15] Configuring Easy-RSA variables...${NC}"
cat > /etc/openvpn/easy-rsa/vars << EOF
set_var EASYRSA_REQ_COUNTRY    "$COUNTRY"
set_var EASYRSA_REQ_PROVINCE   "$PROVINCE"
set_var EASYRSA_REQ_CITY       "$CITY"
set_var EASYRSA_REQ_ORG        "$ORG"
set_var EASYRSA_REQ_EMAIL      "$EMAIL"
set_var EASYRSA_REQ_OU         "$OU"
set_var EASYRSA_KEY_SIZE       2048
set_var EASYRSA_ALGO           rsa
set_var EASYRSA_CA_EXPIRE      3650
set_var EASYRSA_CERT_EXPIRE    365
EOF

# Build the certificate authority
echo -e "${YELLOW}[6/15] Building certificate authority...${NC}"
cd /etc/openvpn/easy-rsa
./easyrsa build-ca nopass

# Generate server certificate and key
echo -e "${YELLOW}[7/15] Generating server certificate and key...${NC}"
./easyrsa gen-req server nopass
./easyrsa sign-req server server

# Generate Diffie-Hellman parameters
echo -e "${YELLOW}[8/15] Generating Diffie-Hellman parameters...${NC}"
./easyrsa gen-dh

# Generate TLS authentication key
echo -e "${YELLOW}[9/15] Generating TLS authentication key...${NC}"
openvpn --genkey secret /etc/openvpn/easy-rsa/pki/ta.key

# Create OpenVPN server directory
mkdir -p /etc/openvpn/server

# Copy certificates to OpenVPN directory
echo -e "${YELLOW}[10/15] Copying certificates to OpenVPN directory...${NC}"
cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/pki/issued/server.crt /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/pki/private/server.key /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/pki/dh.pem /etc/openvpn/server/dh2048.pem
cp /etc/openvpn/easy-rsa/pki/ta.key /etc/openvpn/server/

# Set proper permissions
chmod 600 /etc/openvpn/server/server.key
chmod 600 /etc/openvpn/server/ta.key
chmod 644 /etc/openvpn/server/*.crt
chmod 644 /etc/openvpn/server/dh2048.pem

# Create log directory
echo -e "${YELLOW}[11/15] Creating log directory...${NC}"
mkdir -p /var/log/openvpn
chown nobody:$NOBODY_GROUP /var/log/openvpn
chmod 755 /var/log/openvpn

# Generate initial certificate revocation list
echo -e "${YELLOW}[12/15] Generating initial certificate revocation list...${NC}"
cd /etc/openvpn/easy-rsa
./easyrsa gen-crl
cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/server/
chmod 644 /etc/openvpn/server/crl.pem

# Configure OpenVPN server
echo -e "${YELLOW}[13/15] Configuring OpenVPN server...${NC}"
cat > /etc/openvpn/server/server.conf << 'EOF'
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 0
cipher AES-256-GCM
auth SHA256
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1
crl-verify crl.pem
EOF

# Fix group name for Debian-based systems
if [[ "$PKG_MGR" == "apt" ]]; then
    sed -i 's/group nobody/group nogroup/' /etc/openvpn/server/server.conf
fi

# Configure IP forwarding
echo -e "${YELLOW}[14/15] Configuring IP forwarding and firewall...${NC}"
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
sysctl -p

# Configure firewall rules
if [[ "$FIREWALL_CMD" == "ufw" ]]; then
    ufw allow 1194/udp
    # Add NAT rules for ufw
    sed -i '1i# START OPENVPN RULES\n# NAT table rules\n*nat\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE\nCOMMIT\n# END OPENVPN RULES\n' /etc/ufw/before.rules
    ufw --force enable
else
    # For RHEL-based systems
    if systemctl is-active firewalld &>/dev/null; then
        firewall-cmd --permanent --add-service=openvpn
        firewall-cmd --permanent --add-masquerade
        firewall-cmd --permanent --direct --passthrough ipv4 -t nat -A POSTROUTING -s 10.8.0.0/8 -j MASQUERADE
        firewall-cmd --reload
    fi
fi

# Enable and start OpenVPN service
echo -e "${YELLOW}[15/15] Starting OpenVPN service...${NC}"
systemctl enable $OPENVPN_SERVICE
systemctl start $OPENVPN_SERVICE

# Verification
echo -e "${YELLOW}Verifying installation...${NC}"
if systemctl is-active --quiet $OPENVPN_SERVICE; then
    echo -e "${GREEN}✓ OpenVPN service is running${NC}"
else
    echo -e "${RED}✗ OpenVPN service failed to start${NC}"
    exit 1
fi

if ss -ulpn | grep -q :1194; then
    echo -e "${GREEN}✓ OpenVPN is listening on port 1194${NC}"
else
    echo -e "${RED}✗ OpenVPN is not listening on port 1194${NC}"
    exit 1
fi

echo -e "${GREEN}OpenVPN server installation completed successfully!${NC}"
echo -e "${YELLOW}Next steps:${NC}"
echo "1. Generate client certificates using: cd /etc/openvpn/easy-rsa && ./easyrsa gen-req client1 nopass && ./easyrsa sign-req client client1"
echo "2. Create client configuration files"
echo "3. Configure port forwarding on your router if needed"